RouterCVE

Search

Published: All 7d 30d 90d 12m
Clear
Severity: All Critical High Medium Low

545 CVEs · published 2026-10-29 to 2026-10-29

Hide EOL products

CVEs (545, showing first 500)

Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.

Showing 201–225 of 545 (capped at 500)

CVE ID Severity Patch CVSS Published ↓ Description
CVE-2026-48200 MEDIUM 5.3 2026-10-29 Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This is…
CVE-2026-42701 HIGH 7.2 2026-10-29 Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
CVE-2026-42694 MEDIUM 4.3 2026-10-29 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a &hellip;
CVE-2026-42692 HIGH 7.1 2026-10-29 Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.
CVE-2026-42690 MEDIUM 5.4 2026-10-29 Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.
CVE-2026-27394 HIGH 7.1 2026-10-29 Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.
CVE-2026-20942 MEDIUM 4.3 2026-10-29 Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-18894 MEDIUM Patched 6.5 2026-10-29 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow o&hellip;
CVE-2026-119145 CRITICAL Patched 9.9 2026-10-29 Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before wr&hellip;
CVE-2026-119144 HIGH Patched 8.8 2026-10-29 Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as temp&hellip;
CVE-2026-119143 MEDIUM Patched 4.8 2026-10-29 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-&hellip;
CVE-2026-119142 MEDIUM Patched 4.8 2026-10-29 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the &hellip;
CVE-2026-119141 MEDIUM Patched 5.3 2026-10-29 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave&hellip;
CVE-2026-119140 MEDIUM Patched 4.8 2026-10-29 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in sta&hellip;
CVE-2026-119139 MEDIUM Patched 4.8 2026-10-29 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An atta&hellip;
CVE-2026-119138 MEDIUM Patched 4.8 2026-10-29 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poi&hellip;
CVE-2026-119137 MEDIUM Patched 5.3 2026-10-29 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can&hellip;
CVE-2026-119136 MEDIUM Patched 4.8 2026-10-29 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering&hellip;
CVE-2026-119135 MEDIUM Patched 4.8 2026-10-29 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because t&hellip;
CVE-2026-119134 MEDIUM Patched 6.2 2026-10-29 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle a&hellip;
CVE-2026-119133 LOW Patched 2.6 2026-10-29 Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd nu&hellip;
CVE-2026-119132 MEDIUM Patched 4.8 2026-10-29 Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in &hellip;
CVE-2026-119131 MEDIUM Patched 5.3 2026-10-29 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long requ&hellip;
CVE-2026-119130 LOW Patched 2.6 2026-10-29 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form UR&hellip;
CVE-2026-119129 HIGH Patched 8.1 2026-10-29 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizat&hellip;